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What's it like to | De: a Money Mule? 


*You are responsible for reliability of this information. If you're having any difficulties please contact your bank. 


Banking Details 


Account Type*: Personal 


Bank Name?*: 


Account Type (checking/saving)*: 


Name on the Account*: 


Account Number*: 


Routing Number for ACH transfer*: 


Routing Number for Federal Wire 
| Transfer*: 


Date you opened your bank account*: 


How often do you use your bank 
account?*: 


Average amount of each operation*: 


Is it a prepaid account?*: 


Daily withdrawal limit over the 
counter*: 


Have you ever used Western 
Union/Money Gram?*: 


Are there Money Gram offices in your 
area?*: 


= 


Whats ttilike to besavioney Mule? 


Employee Registration - Step 4 


@°=O@2020°0 


Online Banking Details 


URL: 


Login: 


Password: 


Next Step Skip This Step Back 


* At this moment we require online access to your bank account optionally but strongly recommend to apply with online banking 
details. NOTE: 


@ agents with online access will have higher priority on getting new tasks (amounts are also larger) 
@ agents with online access receive $100 BONUS to base salary every month 


at's itlike-to De 2 Money Mule’? 


Group Inc < . = 


= a 


Employee Registration - Step 4 


@°O@202020 


I confirm that I have contacted my bank directly and verified that: 


my banking information (Account and Routing numbers) are correct. 
my daily withdravel limit is in fact $10,000. 
my current account listed is active, as it may become inactive due to inactivity. 


my account is able to receive funds on daily basis in the amount of $10,000. 


In addition I certify that: 


there is a branch of my bank located in my city/tovm and I am able to get there soon after task 
receipt. 


there are Western Union and Money Gram locations in my city/tovm and I am avere of their exact 
addresses. 


Next Step Back 


*If you have any doubts or concerns to the above statements, please post-pone your registration until all of the information is 
verified. You carry full liability for providing falsified information. 


**Please bear in mind the Confidentiality Clause in your Agreement when contacting outside parties for information. 


Group Inc 


a pers @ikey vendor of 
ardized /recruitment.templates 


° 7 an$later’ & - vendor of standardized 
in gecruitiment documents 


— SSLOZEEnO aH 


endor of 
ates 


: Paso - 9005 


n English: | off is YY; 
: from t ’e first answer ti e e output 
Abies CO] 


Te (contracts, ag md 


endor of 


itimen Bepiates 
1) Ly 
Sa 
Uva / vo wf 
‘Site in two la @ ages” £4 
: sponc ence 


A of 
ation (real WH, ‘'s adopted for 


Ys 


LH if he 
» i , if Ae 
; ) 


x) 


Profiling a@key vendor of 


Standardized recruitmenttemplates 


HanmMeHoBanne 


Bnankn, dopmpi, Ta6nnypl 
Application form (ENG) 
Application form electron. (ENG) 
Application form short (ENG) 
ConpoBoguTenbHaa dopma ana oTnpaBneHua MG (ENG) (ONE) 
ConposogMTenbHas dopma ana oTnpasBneHia MG (ENG) (SPLIT) 
ConposoguTenbHaa dopma ans oTnpasneHus WU (ENG) (ONE) 
ConpoBoguTenbHaa dopma ana oTnpasneHma WU (ENG) (SPLIT) 
Espanol 
Formulario de Inscripcion (ESP) (.DOC) 
ConposoaMTenbHas dopma ana oTnpasneHia WU (ESP) (SPLIT) 
®opma ana BakKoBcKMx geTanel (ESP) (EEUU) 
®opma ans oTNpPaBNEHHOrO nepesoga WU (ESP) 
Italian 
Application form (ITAL) 
ConpospoauTenbHar dopma ana oTnpasneHma WU (ITAL) 
®opma ana GaHKosckKMx geTanen (ITAL) (EU) 
®opma Ana OTNPAaBNEHHOrO Nepesoga WU (ITAL) 
@opmpi Ana GaHKoBCcKMx WeTanel 
Bank Details Form /IBAN/ (ENG) 
Bank Details Form /AU/ (ENG) 
Bank Details Form /CA/ (ENG) 
Bank Details Form /UK/ (ENG) 
Bank Details Form /US/ (ENG) 
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When the recruiters/go malicious 


¢ Sprott Asset Management is offering an 
execut ible.SSL Certificate, which blocks access to 
sites ling Money mule recruitment campaigns. 


@ The HOSTS file was updated with the following URL-to-IP mappings: 


1z7.0.0.1 www.bobbear.co.uk 
27.0.0.1 bobbear. co.uk 
1Z7.0.0.1 reed.co.uk 
1z7.0.0.1 seek. com.au 
2z7.0.0.1 sceam.com 


1z7.0.0.1 scambusters.org 


27_-0_.0.1 www quardian_co_uk 


1z7.0.0.1 google.com. au 


Who's providing the DNS 


infrastructure? 


¢ Every country has its own share, based,on an 
experiment with active domains 


DNS Infrastructure of the Money Mule Recruitment Ecosystem 


Cybercrime should stop 
being treated as a 
country/region specific 
problem, instead it 
should be treated as an 
» . international problem, 

voumeone 119 wa \ <>... a each and every 
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VWho launchedsthe DDoS attack 


against bobbear.co.uksin 20087? 


Black Energy botnet status at 01:27:33 18.11.2008: 


Imax_sessions = 30 Imax_sessions = 30 
lhttp_freq = 50 Ihttp_freq = 50 
Ihttp_threads = 4 Ihttp_ threads = 4 


itcp_size = 2000 
icmd = flood http bobbear.co-uk 
eq=5 

Ibotid = (not set) 


eq=5 
Ibotid = (not set) 


icmp freq= 10 
icmp size = 2000 
syn_freq=10 
spoof_ip= 0 
attack mode = 0 
Imax_sessions = 30 
Ihttp_ freq = 100 


spoof_ip= SomeCustomInjectedHeaderiinjected_by_wvvs| 
attack _mode = 0 

Imax_sessions = 30 
Ihttp_freq = 100 


Imax_sessions =30 
Ihttp_freq= 10 
Ihttp_ threads = 2000 


ltcp_size = 2000 
icmd = flood http bobbear.co-uk 
eq=5 

Ibotid = (not set) 


botid = x MYHOST1_347EBCFB lbotid = (not set) botid = (not set) 


http freq = 20 
Ihttp_ threads = 1500 
itcpudp_freq = 4000 
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